The present invention relates to a safety switching device for connecting and safely disconnecting an electrical load, in particular an electrically driven machine. The safety switching device has at least a first and a second electronic switching element, at least a first and a second output terminal, and at least one input terminal for a first switching signal, which acts on the switching elements.
The invention further relates to a system of safety switching devices having at least two of the above-mentioned safety switching devices.
Safety switching devices of this generic type are primarily used in the industrial sector, in order to connect and, especially, in order to safely disconnect electrically driven machines, such as a brake press or a milling tool. They are particularly used in conjunction with mechanically operated emergency-off buttons to disconnect the machine quickly and reliably in an emergency situation. For this purpose, the power supply for the machine which is to be disconnected is generally passed via make contacts of two relays or contactors acting as switching elements. The switching elements are driven by the safety switching device in a fail-safe manner. As soon as any one of the two switching elements opens its make contacts, the power supply to the machine is interrupted.
Safety switching devices of this type require special approval in many countries since they are used in safety-critical areas. The intrinsic fail-safety of the devices is tested in this process. For the purposes of the present invention, safety switching devices are thus only those which are suitable, by virtue of an appropriate approval, for safety-critical use, in particular those which comply with safety category 3 or higher as defined in European Standard EN 954-1. Furthermore, the term safety switching devices should be distinguished here from so-called safety programmable logic controllers. The former comprise a functionality which is permanently implemented by the manufacturer, for example as a protective guard monitoring device or a two-channel emergency-off switching device. Devices such as these can be configured within predetermined limits in some cases, but their basic function is predetermined and thus, in contrast to a safety programmable logic controller, is not freely programmable by the user.
Safety switching devices, which have been proven in practice, are largely of an electromechanical kind, i.e. said switching elements are based on relays or contactors. One example of such kind of a safety switching device is known from DE 197 36 183 C1. In order to illustrate a usual application of these conventional switching devices, FIG. 1 shows three known safety switching devices, which are denoted by reference symbols 10, 12, 14.
Each safety switching device 10, 12, 14 is a compact, autonomous device with a predetermined functionality. It is accommodated in an enclosure, which is not shown explicitly here but which accommodates the electrical and electromechanical components. The input-side switching signals are fed in via input terminals 16, and output signals are emitted via output terminals 18, 20 which are arranged on the outside of the enclosure, such that they are accessible. A characteristic feature of these conventional safety switching devices is that they each have at least two output terminals 18, 20, which form an output terminal pair. Between each pair of output terminals the make contacts 22, 24 of the electromechanical switching elements are arranged.
In the interior, each safety switching device 10, 12, 14 has a fail-safe evaluation and control unit 26, which evaluates an input-side switching signal in a fail-safe manner, and drives the make contacts 22, 24 accordingly. Depending on the design variant and the required safety category, the evaluation unit 26 is designed as a single-channel or a multi-channel unit. In FIG. 1, each evaluation unit 26 has two evaluation channels 28, 30. During normal operation, the make contacts 22, 24 of the safety switching devices are closed, so that a continuous connection is produced between the output terminals 18 and 20. If the two evaluation channels 28, 30 identify an input-side switching signal, the make contacts 22, 24 are opened, so that the connection between the output terminals 18 and 20 is interrupted. This interruption results in a corresponding machine being stopped.
In practice, a number of switching events, for example the operation of an emergency-off switch 32, the opening of a protective guard 34 or the penetration of a light barrier 36, have to be AND-interconnected. To achieve this, as shown in FIG. 1, the make contacts 22, 24 of a number of safety switching devices 10, 12, 14 are arranged in series. The last safety switching device 14 of the series is usually connected to external contactors 38, 40, which connect or disconnect the power supply to the machine 42. During normal operation, all the make contacts 22, 24 are closed. The contactors 38, 40 are thus live, and the power supply is connected. As soon as one of the above-mentioned switching events is identified by the corresponding safety switching device 10, 12, 14, the associated make contacts 22, 24 are opened. In consequence, the contactors 38, 40 trip, and the power supply to the machine 42 is interrupted.
DE 196 26 129 A1 describes another type of safety switching device in which the electromechanical switching elements are replaced by so-called MOSFETs, i.e. electronic switching elements. Electronic switching elements operate without mechanical contacts and are thus not subject to mechanical wear. Furthermore, they are less expensive than relays today, and they require less space. However, despite these advantages, there is a desire for further improvements.
It is an object of the present invention to specify a low-cost safety switching device of the above-mentioned kind which can be used in a flexible manner.
It is another object of the invention to specify a safety switching device that can be combined with similar devices to form a system of safety switching devices in an easy and cost-effective manner.
It is another object of the invention to specify a system of safety switching devices that easily allows to implement a hierarchical control structure for an installation having several areas to be switched off.
According to one aspect of the invention, this object is achieved in that the first and the second switching element each have an output which provides an output signal at a first potential or at a second potential depending on the first switching signal, with the output of the first switching element being connected to the first output terminal, and the output of the second switching element being connected to the second output terminal.
The new safety switching device has electronic switching elements and thus, in comparison to conventional safety switching devices with contacts, is highly cost-effective and is subject to little wear. In contrast to the safety switching device mentioned before, however, the switching elements used here generate an active output signal with either a high-level or a low-level output value. This output signal can be processed directly in downstream safety switching devices as an input signal.
An advantage is that the number of output terminals required can be reduced for the same number of switching elements since, instead of an output terminal pair, only a single output terminal is required. This saves physical space and costs for the mechanical connecting terminals.
Furthermore, the new safety switching device is very flexible. Specifically, a number of safety switching devices can be connected in series in order to form a logic interconnection. In this case, the output terminals of an upstream safety switching device are connected to the input terminals of a downstream safety switching device to form a system of safety switching devices. In contrast, until now it has only been possible to connect the respective output terminal pairs in series, without any capability to include the input terminals in the interconnection as well. The new circuitry extends the wide range of applications and makes it possible to construct intelligent, hierarchical safety control systems in a simple manner. A further advantage is the capability to connect the safety switching devices in series without any need for complex and expensive components, such as transformers, optocouplers, etc., for driving the switching elements.
Finally, a further advantage is the considerably shorter switching delay times, which is actually of major importance when a number of safety switching devices are connected in series. This is because the switching delay times are cumulative in a series circuit such as this, so that the maximum permissible values have until now been reached with only a small number of devices. A number of safety switching devices according to the invention can now be connected in series, without reaching the switching delay time of a single conventional safety switching device.
In a refinement of the invention, each switching element comprises a series circuit formed by a transistor and at least one resistor, with the series circuit being fed from a supply voltage for the safety switching device such that the output of the switching element can be switched between the two potentials of the supply voltage.
This embodiment of the switching element has been found to be particularly advantageous in practice. In particular, this allows active output signals which are suitable for driving an external actuator to be produced in a simple and direct manner.
In a further refinement of the invention, the safety switching device comprises a logic interconnection unit and at least one further input terminal for supplying at least one further switching signal, with the logic interconnection unit logically interconnecting the at least one further switching signal and the first switching signal to form a combined switching signal.
The logic interconnection is preferably an AND operation. However, it may also be an OR operation, in order to combine, for example, a confirmation button and a protective guard monitor in a simple manner.
This measure has the advantage that the safety switching device is particularly suitable for arrangement in a series circuit, since the output signal from an upstream safety switching device can be combined very easily and in a fail-safe manner with a separate input-side switching signal of the downstream safety switching device. The options for use of the safety switching device can thus be considerably increased. In particular, a flexible, hierarchical safety control system can be formed in a very simple manner. In this case, different actuators, for example external contactors, are driven by different ones of the interconnected safety switching devices. The initiation of a switching event in one safety switching device in the series then results in a corresponding switching event in all the downstream safety switching devices, but not necessarily in the upstream safety switching devices. A hierarchical safety switching device system such as this is particularly advantageous when the disconnection of a specific machine section is intended to lead to disconnection of downstream machine sections, but not upstream machine sections. By way of example, in the case of a hydraulic press, the initiation of a xe2x80x9cright at the frontxe2x80x9d switching signal allows all the pumps and valves to be switched off while a xe2x80x9cat the end of the seriesxe2x80x9d switching signal switches off only a quite specific valve, while the pumps and other valves remain switched on.
The provision of two additional, specific (dedicated) inputs in this case has the advantage that the safety switching device system can be constructed very easily in accordance with the most stringent safety category 4 in European Standard EN 954-1. The switching signals associated directly with the safety switching device can first of all be checked for a cross-connection in the connecting lines, before they are interconnected with the output signal of the upstream safety switching device.
In a further refinement, the safety switching device comprises an mode selector, which allows to choose between at least a first and a second operating mode, with the switching elements supplying steady-state output signals in the first operating mode, and supplying pulsed output signals in the second operating mode.
xe2x80x9cEssentially steady-state output signalsxe2x80x9d are in this case those which appear to be steady-state to a downstream safety switching device of the same type. This does not preclude a situation in which the output signals may nevertheless include signal changes but which are then so short or minor that the downstream safety switching device cannot identify them. Pulsed output signals, on the other hand, may be identified as such and evaluated specifically. This measure makes it possible in a simple way to detect a cross-connection in the connection between two safety switching devices. This allows to comply very easily with the (most stringent) safety category 4 in European Standard EN 954-1 even with interconnected devices.
In a further refinement, the safety switching device has at least two further output terminals and a clock generator, which produces two different clock signals at the two further output terminals.
This measure allows passive signal transmitters, such as emergency-off switches with contacts, to be evaluated very easily in a fail-safe manner, in particular if the signal transmitter is operated only very rarely during operation.
In a further refinement, the safety switching device has a cross-connection monitoring member for the first and second output terminals, wherein the cross-connection monitoring member can be disabled.
This measure allows the output terminals to be connected together in a manner which will be explained in the following text, in order to achieve an increase in current in this way. It is thus possible, for example, to directly drive and to supply a PLC card.
In a further refinement, the safety switching device has at least a first and a second complementary switching element, whose outputs are respectively connected to complementary output terminals of the switching device.
This allows complementary and thus redundant disconnection paths to be set up in a simple way in a safety-critical application, thus further improving the fail-safety overall.
It goes without saying that the features mentioned above as well as the features which are still to be explained in the following text can be used not only in the respectively stated combination but also in other combinations or on their own, without departing from the scope of the present invention.